Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic scans that keep workers busy for minutes.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 8.7 · python-markdownNVD modified 2026-10-29 13:08
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://github.com/Python-Markdown/markdown/issues/798 issue-tracking
- https://github.com/Python-Markdown/markdown product
- https://github.com/Python-Markdown/markdown/issues/1654 issue-tracking
- https://github.com/Python-Markdown/markdown/blob/b41e0aaf1181f1a8cb200cf5a815aad7c0020d23/markdown/inlinepatterns.py#L1155-L1172 technical-description
- https://www.vulncheck.com/advisories/python-markdown-3.0-through-3.11.2-denial-of-service-via-link-bracket-parsing third-party-advisory